Lucene search

K
freebsdFreeBSD555AC165-2BEE-11DD-BBDC-00E0815B8DA8
HistoryMay 21, 2008 - 12:00 a.m.

spamdyke -- open relay

2008-05-2100:00:00
vuxml.freebsd.org
12

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

0.006 Low

EPSS

Percentile

78.1%

Spamdyke Team reports:

Fixed smtp_filter() to reject the DATA command if no valid
recipients have been specified. Otherwise, a specific scenario could
result in every spamdyke installation being used as an open relay.
If the remote server connects and gives one or more recipients that
are rejected (for relaying or blacklisting), then gives the DATA
command, spamdyke will ignore all other commands, assuming that
message data is being transmitted. However, because all of the
recipients were rejected, qmail will reject the DATA command. From
that point on, the remote server can give as many recipients as it
likes and spamdyke will ignore them all – they will not be filtered
at all. After that, the remote server can give the DATA command and
send the actual message data. Because spamdyke is controlling
relaying, the RELAYCLIENT environment variable is set and qmail won’t
check for relaying either. Thanks to Mirko Buffoni for reporting
this one.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchspamdyke< 3.1.8UNKNOWN

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

0.006 Low

EPSS

Percentile

78.1%

Related for 555AC165-2BEE-11DD-BBDC-00E0815B8DA8